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DETAILED ACTION 
Interview Summary 

1 . Applicant conducted an interview witli tine Examiner on 1/4/201 2 concerning 
potential allowable subject matter in claims 1 and 15. Applicant turned down this 
proposal in an electronic mail correspondence, dated 1/4/2012. The electronic mail 
correspondence was made of record in the interview summary mailed on 1/5/2012. 

2. Applicant's representative is reminded that the Office is not able to correspond 
via electronic correspondence without authorization from Applicant. See MPEP 502.03, 
specifically section IV. 

Allowable Subject Matter 

3. Claims 1 2-1 4 are allowed. 

Response to Arguments 

4. Applicant's arguments with respect to claims 1 -9 and 1 5-20 have been 
considered but are moot in view of the new ground(s) of rejection. 

5. Applicant should also review the cited prior art, including the citations of the Geist 
and Daniell references which give additional ways to interpret generating a signature 
using a length of the electronic communication. As indicated in the Examiner interview 
of 12/3/12, the Examiner is willing to negotiate allowable subject matter. However, the 
breadth of claims 1 and 15 and the language in the "analyzing" clause precludes such 
determination at this time. 

Claim Rejections - 35 USC § 103 
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6. The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary sl<ill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

7. Claims 1 -9 are rejected under 35 U.S.C. 1 03(a) as being unpatentable over 
Milliken et al. (US 2004/007361 7) in view of Goodman et al. (US 7,71 1 ,779) in view of 
Mitty et al. (US 2001/0037453) 

8. In regard to claim 1 , Goodman disclosed a method comprising: 

using one or more computer processors, extracting Uniform Resource Locators 
from electronic communication; and (column 7, lines 56-63, identifying a spam message 
based upon the presence of a URL) 

analyzing the URLs extracted to determine whether the electronic communication 
is of a first predetermined category, (column 7, lines 56-63) 

Goodman disclosed extracting URLs from electronic communications. Goodman 
disclosed determining whether a email is spam based upon the presence or absence of 
a URL. Goodman failed to disclose the step of generating signatures or hash values 
based upon the content of the email message. 

However, Milliken disclosed generating signatures or hash values based upon 
the content of the email message. Milliken, [0050], where one or more portions of a 
received email are hashed to produce a hash value. Any portion of the main text, or 
attachments may be hashed. The hash acts as a signature in [0052]. 
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It would have been obvious to one of ordinary skill in the art at the time of 
invention to incorporate the hashing of an email to determine whether the email 
constituted spam, into the Goodman system which used the presence or absence of 
URLs to determine whether an email constituted spam, in order to build a more robust 
spam prevention system. 

Mllllken failed to disclose generating a signature based upon a length of the 
electronic communication. Mllllken did disclose hashing can be performed on "one or 
more header fields" of the email. [0050]. However, Mitty disclosed the generation of a 
"unique waybill ID" [0067] which is a CRC of the encrypted message and a digest of the 
encrypted message. The digest includes the "message length". 

It would have been obvious to one of ordinary skill in the art at the time of 
invention to include a message length in the digesting/signature creation/encryption of a 
message in Milliken, as taught in Mitty, in order to improve the sorting techniques of 
Milliken in regard to building a more robust spam prevention system. 
9. In regard to claim 2, Goodman disclosed the method of claim 1 , wherein 
extracting the URLs comprises extracting at least one of a hostname, a domain name, a 
subsection of a domain relative link, and an Internet Protocol (IP) address from the 
electronic communication. Goodman, col. 7, lines 58-63 and col. 13, lines 45-53. The 
elements of at least one of a hostname, a domain name, a subsection of a domain 
relative link, and an Internet Protocol (IP) address are inherently part of the URL as 
disclosed in Goodman 
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1 0. In regard to claim 3, Milliken disclosed the method of claim 1 , further comprising 
performing a predetermined operation on the electronic communication if the electronic 
communication is determined to be of the first predetermined category. [0080], rejecting 
message if suspicion score is high enough 

11. In regard to claim 4, Milliken disclosed the method of claim 1 , wherein analyzing 
the URLs comprises: 

selecting one or more of the one or more signatures generated; and [0054], 
storing of hash values 

comparing the selected signatures against a plurality of predetermined 
signatures generated from a plurality of known electronic communications of the first 
predetermined category. [0082], checking hashed portions of a message with known 
email lists which have been hashed 

Milliken failed to teach wherein each predetermined signature of the plurality of 
predetermined signatures has a signature based upon an electronic communication 
length and extracted URLs. However, Goodman disclosed extracting URLs from 
electronic communications. Goodman disclosed determining whether a email is spam 
based upon the presence or absence of a URL. Goodman failed to disclose the step of 
generating signatures or hash values based upon the content of the email message. 

It would have been obvious to one of ordinary skill in the art at the time of 
invention to incorporate the hashing of an email to determine whether the email 
constituted spam, into the Goodman system which used the presence or absence of 
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URLs to determine whether an email constituted spam, in order to build a more robust 
spam prevention system. 

Milliken failed to disclose generating a signature based upon a length of the 
electronic communication. Milliken did disclose hashing can be performed on "one or 
more header fields" of the email. [0050]. However, Mitty disclosed the generation of a 
"unique waybill ID" [0067] which is a CRC of the encrypted message and a digest of the 
encrypted message. The digest includes the "message length". 

It would have been obvious to one of ordinary skill in the art at the time of 
invention to include a message length in the digesting/signature creation/encryption of a 
message in Milliken, as taught in Mitty, in order to improve the sorting techniques of 
Milliken in regard to building a more robust spam prevention system. 

1 2. In regard to claim 5, Milliken disclosed the method of claim 1 , wherein generating 
the one or more signatures further comprises: 

computing a first hash based on the length of the electronic communication; 
computing a second hash and generating a signature by concatenating the first hash 
to the second hash. Milliken disclosed hashing portions of an email, [0050]. A fixed 
length of a hash is established in [0055]. Concatenating hashes is taught in [0086]. 

1 3. Milliken failed to disclose an extracted URL was hashed. 

1 4. However, Goodman disclosed using the presence of a URL within an email to 
determine whether an email was spam. Goodman, col. 7, lines 58-63 and col. 13, lines 
45-53 
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1 5. It would have been obvious to one of ordinary skill in the art at the time of 
invention that because Goodman detected whether an email was spam based upon the 
presence of a URL, and because therefore a URL would have been part of an email in 
Goodman, and because Milliken disclosed any portion of an email may be hashed, that 
a URL that was part of an email in Milliken would have been hashed. 

1 6. In regard to claim 6, Milliken disclosed the method of claim 4. Milliken, [0050], 
hashing one or more portions of a received email. Milliken failed to disclose an 
extracted URL was hashed. 

1 7. However, Goodman disclosed using the presence of a URL within an email to 
determine whether an email was spam. Goodman, col. 7, lines 58-63 and col. 13, lines 
45-53 

1 8. It would have been obvious to one of ordinary skill in the art at the time of 
invention that because Goodman detected whether an email was spam based upon the 
presence of a URL, and because therefore a URL would have been part of an email in 
Goodman, and because Milliken disclosed any portion of an email may be hashed, that 
a URL that was part of an email in Milliken would have been hashed. 

19. In regard to claim 7, Milliken disclosed the method of claim 4, wherein generating 
the one or more signatures further comprises generating the one or more signatures 
based on at least one of a protocol, a hostname, a domain name, a subsection of a 
domain relative link, and an Internet Protocol (IP) address from the electronic 
communication. Milliken, [0096], hashing specific headers from an email separately, 
such as the use of Yahoo Groups 
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In regard to claim 8, Milliken disclosed the method of claim 4, further comprising 
classifying the electronic communication to be of the first predetermined category if one 
of the selected signatures matches one of the plurality of predetermined signatures. 
[0082], checking hashed portions of a message with known email lists which have been 
hashed 

20. In regard to claim 9, Milliken disclosed the method of claim 4, wherein the 
plurality of predetermined signatures is derived from a plurality of electronic documents 
reported via a collaborative submission mechanism. Milliken, [0061], preloading of 
hashes from "legitimate email list servers" 

21 . Claims 1 5-1 9 are rejected under 35 U.S.C. 1 03(a) as being unpatentable over 
Milliken in view of Goodman in view of Mitty et al in view of Knowles et al. (US 

5,905,863). 

22. In regard to claim 15, Milliken disclosed a system comprising: 

a server, coupled to the plurality of databases, including: server 120, [0035] 
a memory device to store a plurality of instructions; and 
a processor, coupled to the memory device, to retrieve the plurality of 

instructions from the memory device and to perform operations in response to 

the plurality of instructions, the operations comprising: 

generating one or more signatures of electronic communication 
using a length of the electronic communication...; and Milliken, [0050], 
where one or more portions of a received email are hashed to produce a 
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hash value. Any portion of the main text, or attachments may be hashed. 
The hash acts as a signature in [0052]. 

determining whether the electronic communication is of a first 
predetermined category using the one or more signatures generated. 
Mllliken, [0082], checking hashed portions of a message with known email 
lists which have been hashed to determine if a message is spam or 
suspicious. 

Mllliken failed to disclose hashing the URL extracted from a message. 

However, Goodman disclosed using the presence of a URL within an email to 
determine whether an email was spam. Goodman, col. 7, lines 58-63 and col. 13, lines 
45-53 

It would have been obvious to one of ordinary skill in the art at the time of 
invention that because Goodman detected whether an email was spam based upon the 
presence of a URL, and because therefore a URL would have been part of an email in 
Goodman, and because Milliken disclosed any portion of an email may be hashed, that 
a URL that was part of an email in Milliken would have been hashed. 

Milliken failed to disclose generating a signature based upon a length of the 
electronic communication. Milliken did disclose hashing can be performed on "one or 
more header fields" of the email. [0050]. However, Mitty disclosed the generation of a 
"unique waybill ID" [0067] which is a ORG of the encrypted message and a digest of the 
encrypted message. The digest includes the "message length". 
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It would have been obvious to one of ordinary skill in the art at the time of 
invention to include a message length in the digesting/signature creation/encryption of a 
message in Milliken, as taught in Mitty, in order to improve the sorting techniques of 
Milliken in regard to building a more robust spam prevention system. 

Milliken and Goodman failed to disclose a plurality of databases to store a 
plurality of signatures of a plurality of known electronic communications of a first 
predetermined category. Milliken did disclose comparing known signatures of email 
messages. Milliken failed to disclose the signatures compared were stored in a plurality 
of databases. 

However, Knowles did disclose use of multiple databases to compare message 
content to determine if a message was a reply to another message. Knowles, column 
5, lines 2-4 disclosed the multiple databases of different content, and column 5, lines 
53-64 disclosed the querying of multiple databases of email content. 

It would have been obvious to one of ordinary skill in the art at the time of 
invention that Milliken's hash signatures would have been storable in a plurality of 
databases for purposes of data backups and storage of different types of data. 
23. In regard to claim 1 6, Goodman disclosed the system of claim 1 5, wherein the 
URLs comprises at least one of a hostname, a domain name, a subsection of a domain 
relative link, and an Internet Protocol (IP) address. Goodman, col. 7, lines 58-63 and 
col. 13, lines 45-53. The elements of at least one of a hostname, a domain name, a 
subsection of a domain relative link, and an Internet Protocol (IP) address are inherently 
part of the URL as disclosed in Goodman 
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24. In regard to claim 1 7, Milliken disclosed the system of claim 1 5, wherein the 
operations further comprise selecting the one or more of the plurality of signatures 
based on a plurality of predetermined criteria. [0068], hash the main text of the body 
and [0070], hash the attachments of the email. Also see [0050]. The use of hash 
blocks in [0050] is selecting a signature generated based on a plurality of predetermined 
criteria. 

25. In regard to claim 1 8, Milliken disclosed the system of claim 1 5, wherein the 
operations further comprise performing a predetermined operation on the electronic 
communication if the electronic communication is determined to be of the first 
predetermined category. Milliken, [0082], checking hashed portions of a message with 
known email lists which have been hashed to determine if a message is spam or 
suspicious. 

26. In regard to claim 1 9, Knowles disclosed the system of claim 1 5, further 
comprising a database, coupled to the server, to store a plurality of reports from which 
the plurality of predetermined signatures are generated. Knowles, col. 5, lines 55-58. 

27. Claim 20 is rejected under 35 U.S.C. 103(a) as being unpatentable over Milliken 
in view of Goodman in view of Knowles as applied to claim 15 above, and further in 
view of Official Notice. 

28. In regard to claim 20, Milliken in view of Goodman in view of Knowles disclosed 
the system of claim 15. The combined references failed to disclose wherein the plurality 
of databases are in a remote location from the server. However, Official Notice is taken 
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that databases were commonly stored in remote locations from a server at the time of 
invention to allow for remote storage of data and for emergency management 
procedures in case of catastrophic events. It would have been obvious to one of 
ordinary skill in the art at the time of invention to remotely store databases in the 
Milliken/Goodman/Knowles combination. 
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Conclusion 

29. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

30. OIkin et al. US 2003/0074552 

31 . Geist et al. US 2005/0038754 

32. Geist specifically teaches the commonly known technique of creating a hash by 
using a hash function H which transforms an input string of length m to an output that 
always has a fixed size string h, where h = H(m). Here, m is equivalent to the "length of 
the electronic communication". 

33. Danielletal. US 2005/0091321 

34. Daniell states in claim 1 creating a "32-bit string indicative of the length of the 
email message", and appending this to a generated MD5 hash. 

35. Syiek et al. US 2009/01 32670 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Jeffrey R. Swearingen whose telephone number is 
(571)272-3921 . The examiner can normally be reached on M-F 8:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Lynn Feild can be reached on 571-272-2092. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 


Jeffrey R Swearingen 
Primary Examiner 
Art Unit 2445 


/Jeffrey R Swearingen/ 
Primary Examiner, Art Unit 2445 


